Most SOC teams claim MITRE ATT&CK coverage they don't actually have. Not because they're lying — because there's a real difference between "we have a rule that touches this technique" and "we can reliably detect this technique in our environment with acceptable false positive rates." Coverage mapping done properly tells you what you actually have, what you think you have but don't, and what matters most to build next. Here's how to do it without a dedicated tool or a six-month project. Before you map anything, agree on what "coverage" means. Vague coverage claims are worse than no claims because they create false confidence. Use three levels: If you're unsure whether a rule deserves L3 or L2, check the last 30 days of alert history. If it fired zero times and your environment should theoretically have triggered it, it's L2 at best — something in the detection logic isn't matching your environment's actual data. Based on coverage gaps that appear consistently across enterprise SOCs, these are the techniques most likely to show L1 gaps even in mature programs: Attackers using legitimate credentials look exactly like legitimate users. Detection requires behavioral baselines — time-of-day patterns, location patterns, access scope — not just event-based rules. Most orgs have the events but not the behavioral layer. This is the most dangerous L1 gap in most environments because it's the technique used in almost every significant breach. Attackers disabling your EDR or clearing event logs. You need to be alerted on this. A detection engineering shop that doesn't have coverage here is in a very dangerous position — an attacker who can turn off your visibility without triggering an alert owns the environment. New local admin accounts created on endpoints, especially outside of provisioning windows or in bulk. Frequently present in ransomware pre-deployment activity and almost always an L2 gap — visible in 4720 events but not alerted on. Lateral movement via SMB is one of the most common techniques in ransomware deployment chains and one of the most consistently uncovered in enterprise environments. CrowdStrike detects some of this behaviorally, but Sentinel and Splunk environments without Sysmon or explicit SMB logging have significant visibility gaps here. With a completed coverage map, prioritize the build backlog using three factors: Report coverage as "X techniques at L3 confidence out of Y techniques relevant to our threat profile" — not as a percentage of the full ATT&CK matrix. The full matrix has 200+ techniques; most orgs are only realistically targeted on 40-60. Denominator matters. Every Tuesday issue ships with the detection rule, the MITRE ATT&CK technique ID and sub-technique mapping, the data sources required, and the investigation steps an analyst needs to close the alert. Tracking your coverage gets easier when every new rule comes pre-mapped.